Composer JSON Validator#

Validate and lint PHP Composer composer.json files for structure, dependencies, autoload configuration, and best practices.

Commands#

lint — Run all lint checks#

bash

python3 scripts/composer_json_validator.py lint composer.json
python3 scripts/composer_json_validator.py lint composer.json --strict
python3 scripts/composer_json_validator.py lint composer.json --format json
python3 scripts/composer_json_validator.py lint composer.json --format markdown

dependencies — Inspect require/require-dev#

bash

python3 scripts/composer_json_validator.py dependencies composer.json
python3 scripts/composer_json_validator.py dependencies composer.json --format json

scripts — Inspect scripts section#

bash

python3 scripts/composer_json_validator.py scripts composer.json
python3 scripts/composer_json_validator.py scripts composer.json --format markdown

validate — Full validation (structure + lint + summary)#

bash

python3 scripts/composer_json_validator.py validate composer.json
python3 scripts/composer_json_validator.py validate composer.json --strict --format json

Flags#

FlagDescription--strictExit code 1 on warnings (CI-friendly)--format textHuman-readable output (default)--format jsonMachine-readable JSON--format markdownMarkdown report

Lint Rules (22 checks)#

Structure (5)#

1. Valid JSON syntax
2. Required fields: name, description, type
3. Valid package name format ( vendor/package)
4. Valid type value ( library, project, metapackage, composer-plugin)
5. license field present and valid SPDX identifier

Dependencies (6)#

1. No duplicate packages across require and require-dev
2. Version constraints use valid operators ( ^, ~, >=, etc.)
3. No dev-only packages in require (phpunit, mockery, etc.)
4. No wildcard * versions
5. PHP version constraint present in require
6. ext-* dependencies are explicit (not *)

Autoload (4)#

1. PSR-4 autoload defined
2. Namespace ends with \\ (PSR-4 convention)
3. No duplicate namespaces across autoload entries
4. autoload-dev separate from autoload

Best Practices (7)#

1. scripts section present
2. No post-install-cmd/ post-update-cmd executing arbitrary URLs
3. config.sort-packages enabled
4. minimum-stability explicit when not stable
5. prefer-stable set when minimum-stability is not stable
6. No hardcoded absolute paths in autoload
7. All repository URLs use HTTPS

Exit Codes#

CodeMeaning0No errors (warnings allowed unless --strict)1Errors found (or warnings in --strict mode)2Invalid arguments / file not found

Example Output#

text

composer.json lint results
==========================
[ERROR]   name: Package name must match vendor/package format
[WARN]    dependencies: phpunit/phpunit found in require (should be in require-dev)
[WARN]    autoload: config.sort-packages not enabled
[INFO]    scripts: scripts section present

Summary: 1 error(s), 2 warning(s), 1 info